New LLM framework detects vulnerable APIs in large Java codebases with 95% recall

Security researchers have introduced CognixShield, an LLM-based system designed to identify insecure application programming interfaces (APIs) in large Java applications before they become exploitable vulnerabilities. The tool addresses a persistent challenge in software security: finding problematic API calls hidden within millions of lines of code.

The scaling problem#

Integrating third-party open-source libraries into Java projects carries inherent security risks, yet detecting when those libraries are used unsafely remains difficult. Traditional static analysis tools and deep learning approaches struggle to trace how data flows between functions and across files—the inter-procedural context that determines whether an API call is actually dangerous. Meanwhile, large language models (LLMs), despite showing promise for understanding code semantics, hit practical roadblocks: context windows are too narrow to hold entire codebases, and they lack built-in knowledge about what makes a particular API call exploitable.

How CognixShield works#

The framework tackles these limitations through three interconnected mechanisms. Semantic-preserving code fragmentation uses abstract syntax trees (ASTs) to partition large applications into smaller chunks that fit within LLM context limits while keeping the code syntactically intact. Vulnerability-aware retrieval-augmented generation (RAG) employs multiple AI agents that trace relevant security context across fragments, stitching together function calls and file dependencies that matter for vulnerability assessment. Proof-of-Vulnerability reasoning applies specific test cases that encode how a vulnerability is actually triggered and exploited, grounding the model's judgments in concrete attack mechanics rather than abstract patterns.

Performance and impact#

In testing against 57 real-world Java applications, CognixShield achieved 95% recall (catching vulnerable APIs), 84% precision (minimizing false alarms), 84% accuracy overall, and an 89% F1-score. These results surpassed existing state-of-the-art detection tools. The researchers emphasize that effective vulnerability detection requires specialized architectural thinking tailored to security rather than generic LLM applications.

The work, published on arXiv, suggests a path forward for securing large codebases as reliance on open-source dependencies continues to grow.